Learning by Doing: CISCO Certified Network ... - SCN Research

goodguys#show access-list
Extended ip access list 100
permit icmp any any echo (610 matches)
permit icmp any any echo-reply
permit udp any any eq echo
permit udp any any eq echo any
permit tcp any any established
permit tcp any any
permit ip any any (88 matches)
We have a good clue that an icmp flood (DoS) is occurring because of the large
number of matches. Next we need to log our inputs and view the source ip
addresses.
7. To start logging we just tack it on the end of the line with our matches. We don’t
do it right away because it chews up valuable router resources. We save it for
when we need it. First we copy and paste our acl to a notepad. Then we erase
access-list 100 from our router:
goodguys(config)#no access-list 100
Then we make the changes to our acl in the notepad and then copy and paste it
back into our router. Since we are interested only in the icmp section that will be
all that is put back. In this manner we are conserving our resources. Since the
icmp is throwing up a “red flag” with us we opt to log it and enable logging to run
as the events happen:
goodguys(config)#access-list 100 permit icmp any any echo log-input
goodguys(config)#access-list 100 permit icmp any any echo-reply
goodguys(config)#logging buffered
The last line will let us see any notices as they occur…we will also see them in
the log.
8. Next start ethereal on 192.168.1.2 and then start the pings again from 172.16.1.2.
9. Now we can repeat our ping storm, stop it, stop our ethereal and view our log:
goodguys(config)#sh log
You should see something like this:
goodguys#sh log
Syslog logging: enabled (0 messages dropped, 0 flushes, 0 overruns)
Console logging: level debugging, 49 messages logged
Monitor logging: level debugging, 0 messages logged
Buffer logging: level debugging, 19 messages logged
Trap logging: level informational, 53 message lines logged
356